home

2rs3.dll

ADPeak Inc

Part of an Adpeak program that shows ads in the browser without providing information about the ad's origin. Ads are injected as banners or text-links in random web pages. The module 2rs3.dll by ADPeak Inc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘2rs3’. This file is typically installed with the program suprasavings by Opiniads which is a potentially unwanted software program.
Publisher:
ADPeak Inc  (signed and verified)

MD5:
bb9a12ee2fd0f796bc23f9db41686aa8

SHA-1:
226675126ec5701bbf78653f4794ca008255af7e

SHA-256:
8e7c96c4098756c853b2d89c489183e476de5dc19e992b727538074ba1951cc4

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Injects advertisements in the web browser in the form or banner ads and popups.

Analysis date:
4/16/2024 6:23:46 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Adpeak (M)
15.12.19.0

File size:
89 KB (91,104 bytes)

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\Program Files\suprasavings\2rs3.dll

Digital Signature
Signed by:
ADPeak Inc

Authority:
DigiCert Inc

Valid from:
2/25/2014 6:00:00 PM

Valid to:
3/2/2015 6:00:00 AM

Subject:
CN=ADPeak Inc, O=ADPeak Inc, L=SARASOTA, S=Florida, C=US, PostalCode=34233, STREET=5760 Mead Ave, SERIALNUMBER=5016610, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization

Issuer:
CN=DigiCert EV Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
06C60DAA1859106255274CBE617ADF86

Registration
CLSID:
{10AD2C61-0898-4348-8600-14A342F22AC3}

COM registered:
Yes

File PE Metadata
Compilation timestamp:
3/21/2014 3:30:44 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
1536:uc2lu94Lfni/qbIqwaksvnHB52xCezrR3:OAeLfA855bezr9

Entry address:
0x2F46

Entry point:
8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 43, 2F, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 50, 44, 01, 10, 89, 0D, 4C, 44, 01, 10, 89, 15, 48, 44, 01, 10, 89, 1D, 44, 44, 01, 10, 89, 35, 40, 44, 01, 10, 89, 3D, 3C, 44, 01, 10, 66, 8C, 15, 68, 44, 01, 10, 66, 8C, 0D, 5C, 44, 01, 10, 66, 8C, 1D, 38, 44, 01, 10, 66, 8C, 05, 34, 44, 01, 10, 66, 8C, 25, 30, 44, 01, 10, 66, 8C, 2D, 2C, 44, 01, 10, 9C, 8F, 05, 60, 44...
 
[+]

Entropy:
6.4578

Code size:
53.5 KB (54,784 bytes)

Internet Explorer BHO
CLSID:
{10AD2C61-0898-4348-8600-14A342F22AC3}

CLSID name:
2rs3


The file 2rs3.dll has been discovered within the following program.

suprasavings  by Opiniads
Injects advertising in the user's web browser and is included in download bundles from distributors such as Apps Installer SL. From the installer: "After installing SupraSavings, you may receive ads as you browse the web that are identified as SupraSavings advertisements.
84% remove it
 
Powered by Should I Remove It?

Remove 2rs3.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.